The Linux kernel's HID picolcd driver contained a vulnerability where picolcd_debug_eeprom_read() trusted a length byte (resp->raw_data[2]) supplied by the device in its REPORT_EE_DATA reply. This length byte was only clamped to the caller's read() count but never checked against resp->raw_size, the actual number of bytes received. A malicious or spoofed picoLCD device returning a length byte of 0xff and a read count >= 255 could cause copy_to_user() to read beyond the allocated raw_data[] buffer into adjacent slab memory, leaking kernel memory to userspace via the debugfs "eeprom" file. The debugfs file is root-only (S_IRUSR), and a crafted device is required to trigger this. The fix clamps the copy length to resp->raw_size - 3 (payload size minus header), preventing out-of-bounds reads.

This vulnerability can lead to an out-of-bounds read in kernel memory, potentially leaking sensitive kernel memory contents to a privileged user via the debugfs eeprom interface. However, exploitation requires root access to read the debugfs file and a crafted or spoofed picoLCD device, limiting the attack surface. There is no indication of remote or unprivileged exploitation.

A fix is available that clamps the read length to the actual received payload size, preventing out-of-bounds reads. Users should update to a Linux kernel version that includes this patch. Since the debugfs file is root-only and a crafted device is required, no additional mitigation is necessary beyond applying the official fix.